Spend control for AI agents, enforced on Solana
Ash puts the rules on the network, not on our servers. Several limits at once, a list of where money may go, an emergency pause, and a history nobody can quietly edit. You take your money back alone, any time.
Devnet today. Professional audit before mainnet.
If a withdraw tool exists, the model can be talked into calling it.
The first transfer had already landed. Now it lands twice.
Off-chain limits don’t help: whoever owns the process owns the limit.
In all three, the worst case is the whole balance.
Think of a corporate card with four people. Each one passes down only a limit at or below what they received.
Puts money in, takes it out, sets the ceiling, can switch everything off. Withdraws alone, even while paused.
Sets the day-to-day policy under the ceiling. Cannot raise it, cannot withdraw.
Holds only the emergency button. The worst a rogue guardian can do is pause the agent.
Pays within policy until its session expires. Its key authorizes a payment, never a limit.
Tightening a limit takes effect on the next payment. No redeploy, no waiting.
A third party checks the history on the network without taking our word for it. That is what an attestation is.
One script reproduces three attacks on public devnet and prints a report with explorer links.
pnpm build && scripts/demo.sh --wallet ~/.config/solana/id.jsonCeilings, an emergency pause and a console. Start on devnet in an afternoon.
Book 20 minutesCost per agent, per team, per task, and a quarterly attestation: every payment inside policy, nothing omitted.
Book 20 minutesA loss envelope for agents that trade: a mandate with a floor your LPs can check. In design, with the first desks.
Talk to usOpen protocol, Apache-2.0. We charge for the operations around it, never a toll on your payments.
You should ask. A single cap is now free and audited. A cap alone is not governance.
| Native allowances | Ash |
|---|---|
| One delegate, one cap | Per-payment, per-window and lifetime limits at once |
| Any destination | Allowlisted destinations and tokens |
| The owner is the only brake | A pause key separate from the owner |
| History as good as your indexer | A hash chain that proves nothing was deleted |
Ash composes with the native primitive. We build on it, not against it.
We want twenty minutes: what it pays for, how much it could lose, what you have tried. We are validating this with the first teams and will say so plainly.